JFR Sec
--:--:--
Back to catalog
Risk AssessmentCVSS 7.4 · High

Botium Toys – NIST CSF Compliance Audit & Risk Assessment

Full-scope security risk assessment for a mid-size e-commerce retailer, mapping asset inventory and NIST CSF gaps to a prioritized risk mitigation matrix.

2025-11-023 weeks
Risk AssessmentNIST CSFComplianceAsset Inventory
[ VIEW REPO]
Executive Summary

Botium Toys, a growing online retailer, engaged this assessment after rapid infrastructure expansion outpaced its security controls. Assets across corporate, e-commerce, and point-of-sale environments were inventoried and scored against the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover). The engagement surfaced one critical finding — unencrypted customer PII in a legacy order database — alongside high-risk gaps in asset ownership and network segmentation. A risk mitigation matrix was delivered to the executive team, ranking remediation work by likelihood x impact so budget could be allocated to the highest-leverage fixes first.

Scope
  • Corporate network across 3 office sites
  • Public e-commerce web application and checkout flow
  • Point-of-sale terminals (retail floor)
  • Cloud storage and compute (AWS)
Overview

The assessment inventoried physical, network, and application assets, then scored risk using likelihood x impact against the NIST Cybersecurity Framework, producing a control-gap register the client could action directly.

Objectives
  • Inventory all physical, digital, and cloud assets
  • Map existing controls to the NIST CSF functions
  • Score residual risk and prioritize a remediation backlog
  • Deliver an executive-readable risk register and mitigation roadmap
Methodology
  1. 1Asset discovery and classification workshop with IT stakeholders
  2. 2Threat and vulnerability identification per asset class
  3. 3NIST CSF gap analysis (Identify / Protect / Detect / Respond / Recover)
  4. 4Likelihood x impact risk scoring against the client's risk appetite
  5. 5Risk mitigation matrix with owners and target remediation dates
Command Log
session_log.sh

# Enumerate exposed subdomains

$ subfinder -d botiumtoys.example -silent | httpx -silent

shop.botiumtoys.example [200]
api.botiumtoys.example [200]
staging.botiumtoys.example [200]
old-cms.botiumtoys.example [200]

# Baseline external attack surface

$ nmap -sV -Pn -T4 -oA botium_ext botiumtoys.example

PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx 1.18.0
443/tcp  open  https   nginx 1.18.0
3306/tcp open  mysql   MySQL 5.7.26

# Check for exposed cloud storage

$ aws s3 ls s3://botium-assets --no-sign-request

PRE product-images/
PRE order-exports/
PRE db-backups/
Findings

Unencrypted PII at rest in legacy order database

Customer PII stored without column-level encryption on the legacy MySQL order archive, directly exposed via the misconfigured S3 backup bucket.

Critical

No formal asset inventory

35% of cloud compute instances were untagged and unowned, preventing consistent patch and access reviews.

High

Flat internal network segmentation

POS terminals shared a VLAN with corporate workstations, allowing lateral movement from a phished endpoint to payment infrastructure.

Medium
Risk Mitigation Matrix
AssetThreatLikelihoodImpactRiskTreatment
Legacy order database (PII)Unauthorized data exposure via misconfigured backupsMediumHighCriticalEncrypt at rest, rotate keys, restrict bucket ACLs
Cloud compute instancesShadow IT / unmanaged, unpatched assetsHighMediumHighDeploy CMDB with automated tagging enforcement
POS network segmentLateral movement from corporate LANMediumHighHighVLAN segmentation with explicit firewall ACLs
Employee credentialsPhishing and credential reuseHighMediumHighEnforce MFA org-wide, run security awareness training
Remediation
  • Implement column-level encryption and key rotation for PII stores
  • Deploy a CMDB with automated cloud tagging enforcement
  • Segment POS and corporate VLANs with default-deny firewall ACLs
  • Formalize NIST CSF-aligned control ownership across teams